Can this app index data from multiple domains? We are in an environment that has multiple trusted AD domains and we want to use this app to index all of the domains.
Yes, as long as you have 1 Windows Splunk Forwarder system per Domain collecting admon data, with an initial baseline admonEventType="Sync" collected for each.
there is no way around this by having one UF on a DC collecting the whole domain/forest data from the GC?
Yes, as long as you have 1 Windows Splunk Forwarder system per Domain collecting admon data, with an initial baseline admonEventType="Sync" collected for each.